{"id":"GHSA-cpf9-ph2j-ccr9","revision":"2e89cb9a2b83413a9882ee31116f6769","records":[{"revision":"2e89cb9a2b83413a9882ee31116f6769","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-cpf9-ph2j-ccr9","aliases":["CVE-2026-40303","GO-2026-5329"],"title":"zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing","description":"**Summary**\nendpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.\n\n- Attack Vector: Network — exploitable via a single HTTP request with a crafted Cookie header.\n- Attack Complexity: Low — no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).\n- Privileges Required: None — reached before JWT validation or any authentication check.\n- User Interaction: None.\n- Scope: Unchanged — impact is confined to the affected proxy process.\n- Confidentiality Impact: None.\n- Integrity Impact: None.\n\nAvailability Impact: High — sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.\n\n**Affected Components**\n- endpoints/oauthCookies.go — GetSessionCookie (line 81)\n- endpoints/publicProxy/authOAuth.go — handleOAuth (line 50) — call site, pre-auth\n- endpoints/dynamicProxy/cookies.go — getSessionCookie (line 29) — call site","state":0,"publishedAt":"2026-04-16T21:09:08+00:00","modifiedAt":"2026-06-25T19:56:15.928295+00:00","affected":[{"ecosystem":"Go","name":"github.com/openziti/zrok","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.1.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openziti/zrok/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9","https://nvd.nist.gov/vuln/detail/CVE-2026-40303","https://github.com/openziti/zrok","https://github.com/openziti/zrok/releases/tag/v2.0.1"],"sourceUrl":"https://github.com/advisories/GHSA-cpf9-ph2j-ccr9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cpf9-ph2j-ccr9","identifiers":["GHSA-cpf9-ph2j-ccr9","CVE-2026-40303","GO-2026-5329"]},"retained":false,"historicalAffected":[]}],"coverage":[]}